CVE-2026-120638

A vulnerability exists in perl-cgi (CGI versions before 5.00) where the redirect function decodes HTML entities in target URLs after the application has performed validation. This allows a remote attacker to supply a specially crafted URL—such as //evil.example/—which becomes //evil.example/ ...